Security Alert Summary
The WP Data Access plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its wpda_app shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts via shortcode attributes. Injected scripts will execute when a page containing the injected shortcode is viewed.
CVE Details
- CVE ID: CVE-2026-0557
- Affected component: WP Data Access plugin for WordPress
- Affected versions: All versions up to, and including, 5.5.63
- Published: February 14, 2026 at 7:16 AM
- Last modified: February 14, 2026 at 7:16 AM
- CVSS v3.1: Base Score 6.4, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW (authenticated user with contributor-level access or higher)
- User Interaction: NONE
- Scope: CHANGED
- Confidentiality Impact: LOW
- Integrity Impact: LOW
- Availability Impact: NONE
- CWE / Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Stored Cross-Site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue rooted in insufficient input sanitization and output escaping of user-supplied attributes for the plugin’s wpda_app shortcode. Because the plugin accepts attributes from authenticated users and does not properly sanitize or escape those values before rendering them in pages, an attacker with contributor-level access or higher can store malicious JavaScript in a shortcode attribute. That script is then served as part of the page content and executes in the context of any user who views the affected page.
The CVE description specifically identifies the lack of input sanitization and output escaping on user-supplied attributes of the wpda_app shortcode as the root cause. The impact is limited to script execution in the browsers of users who load pages containing the injected shortcode; it does not, by itself, indicate direct remote code execution on the server.
How This Could Impact Your Website
Consider a small site with a site owner (administrator), an internal editor, and an external contributor who adds content via shortcodes. If a contributor injects a malicious script into a page using the vulnerable wpda_app shortcode, any staff member or visitor who views that page could have that script run in their browser. Practical consequences include exposure of session cookies or user-visible data, and increased risk of targeted phishing or social engineering against staff whose email addresses or roles are visible on the site.
For example, a contributor could add a shortcode attribute containing script that captures form inputs or displays a fake login prompt to site editors; when an editor visits the page, the script executes and could capture credentials or other sensitive input. Impact aligns with the CVSS ratings: confidentiality and integrity impacts are rated LOW, and availability is not affected according to the provided data.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor access for untrusted accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior or newly created content containing unexpected HTML or script.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
